🛡️ NAIL Institute — AVE Database

← Back to Database

Environment Inheritance Leak

🟠 HIGH credential proven AVE-2025-0104

· aka: MCP Environment Exposure, Subprocess Credential Inheritance, Supply Chain Secret Leak

Summary

Agentic frameworks pass the full parent process environment (os.environ.copy()) to spawned subprocesses — including MCP servers, code interpreters, and tool executors — exposing all API keys, database credentials, and cloud access tokens to untrusted or third-party code.

Blast Radius

All environment variables accessible to the parent process are exposed to untrusted subprocesses. Supply chain attacks can silently exfiltrate credentials via HTTP callbacks.

Prerequisites

Framework that spawns subprocesses for tool/MCP execution. Secrets stored in environment variables (standard practice).

Environment

  • Frameworks: PraisonAI
  • Multi-agent: No
  • Tools required: Yes
  • Memory required: No

Known Defences

  • Environment Allowlisting — ? layer
  • Sensitive Pattern Filtering — ? layer

🔒 Full defence implementations available through the NAIL SDK.

Related